2
$\begingroup$

I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. Since the iv would be send in plaintext I thought I could also generate a HMAC of the iv and the encrypted text and append this mac to the cipher.

mac: HMAC(iv || encryptedText)

The cipher would look like this: iv || encryptedText || mac

The receiver can now proof the authenticity and integrity of the iv and the encrypted text and then decrypt the data.

Are there any security breaches? Is it even necessary to create a mac?

Thanks!

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

No, the HMAC is not required. The value of the IV - or rather nonce for GCM - is included in the GMAC algorithm which calculates the authentication tag for GCM; it is explicitly made part of the GMAC calculation. So if the adversary changes the IV then the authentication tag will not verify. It depends on the library used, but it may be that the authentication tag is automatically tagged onto the end of the ciphertext.

One particular issue is that you get the same "verification error" if any of the GCM input changes. So you cannot detect what was the cause or causes of the error. Generally this is not an issue though; you test sender / receiver and if verification fails the ciphertext is discarded in its entirety.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thanks. What if I use AES-CBC instead of GCM? $\endgroup$
    – LUMPAAK
    Dec 21, 2022 at 13:24
  • 1
    $\begingroup$ @LUMPAAK: CBC does not provide any integrity guarantees; you need something (such as HMAC) to do that. $\endgroup$
    – poncho
    Dec 21, 2022 at 13:56
  • 1
    $\begingroup$ GCM is an authenticated (AEAD) cipher, CBC is not. For CBC you would try and use encrypt-then-mac, i.e. you would create an authenticated cipher for it. There is a draft RFC here where the IV is included in the ciphertext and thus authenticated. Yes, it is a draft, but at least that is better than most of the self-made stuff out there. Oh, almost forgot, the padding that that RFC draft describes is called PKCS#5 or PKCS#7 padding. $\endgroup$
    – Maarten Bodewes - on strike ♦
    Dec 21, 2022 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.